Sensor failed to register with HrError [0x80072F8F] after successful installation
Article ID: 288486
Updated On:
Products
Carbon Black EDR
Issue/Introduction
- Sensor failed to register and does not appear in the UI
- Network capture shows Handshake Failure, denied by Server
- sensor.log from sensor diagnostics shows:
Tid[0574] 2019-08-20 07:08:10 (w): Failed to registerHTTPCode[2147954575] HrError[0x80072F8F]
Tid[0574] 2019-08-20 07:08:10 (i): failed to register HrError[0x80072F8F]
Tid[0574] 2019-08-20 07:08:10 (w): Unable to properly synch with server HrError[0x80072F8F]
Environment
- Carbon Black EDR Sensor: All Supported Versions
- Operating System: All Supported Versions
Cause
Unsupported Cipher Suites are being used on client endpoint.
Resolution
Enable at least one cipher suite to match in order to complete the TLS handshake. If there is no match there are two options:
- Enable a matching cipher suite on the endpoints > How to Determine Cipher Matching Between Endpoint and Server
- Enable Ciphers on the Server > How to Update EDR SSL Ciphers Used for Communication
Additional Information
- Do not enable strict validation if you are using the legacy certificate created during Carbon Black EDR server installation. Using strict validation for this or any other certificate that cannot pass validation will disable communication between the sensor and server on some sensors that support the certificate management features, and can require uninstalling and reinstalling sensors.
- For Hosted Carbon Black EDR, choose one of the following Ciphers:
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_RSA_WITH_AES_256_GCM_SHA384
Feedback
Yes
No
Powered by
